CFC Digital Forensics & Cybercrime 2

Question 1

Which file system artifact is most useful for identifying files that were deleted but previously accessed on an NTFS volume?

Accepted Answer

$Recycle Bin INFO2 or $I files

Answer

The $Recycle Bin contains $I files (Windows Vista+) or INFO2 records that store the original path, deletion timestamp, and file size of deleted items.

Question 2

A forensic examiner discovers a 'slack space' artifact. What does this term specifically refer to?

Accepted Answer

The space between the end of a file's logical size and the end of its last allocated cluster

Answer

File slack (also called RAM slack + drive slack) is the unused space between the logical end of a file and the physical end of the last cluster allocated to it.

Question 3

Under the Computer Fraud and Abuse Act (CFAA), which element is NOT required to establish criminal liability for unauthorized computer access?

Accepted Answer

Proof the defendant received financial gain

Answer

Financial gain is not required for all CFAA offenses; some subsections only require unauthorized access with intent to defraud or to obtain information.

Question 4

When analyzing a Windows registry hive for forensic evidence, which hive contains user-specific settings such as recently accessed files and installed software per user?

Accepted Answer

NTUSER.DAT

Answer

NTUSER.DAT is the per-user registry hive located in each user's profile folder and stores personalized settings, MRU lists, and user-specific software keys.

Question 5

In network forensics, what is the primary purpose of capturing pcap (packet capture) files at the time of an incident?

Accepted Answer

To preserve full packet-level evidence of network communications for later analysis

Answer

Pcap files capture raw network traffic including headers and payloads, providing a complete record of communications that can be replayed and analyzed forensically.

(CFC) Certified Forensic Consultant Practice Test

(CFC) Certified Forensic Consultant Practice Test

CFC Digital Forensics & Cybercrime 2